Barbican MKEK Model

This effort will enhance the scalability of Barbican by removing possible
limitations on the number of tenant keys that can be stored in an attached HSM.
We propose adding a new plugin that implements a Master Key Encryption (MKEK)
based model for utilising an attached HSM appliance. Under this model, locally
stored Data Encryption Keys (DEKs) are protected by per-tenant Key Encryption
Keys (KEKs) that are themselves protected by the use of a Master Key Encryption
Key (MKEK). Please see the spec for more details.